pipfilelock

Pipfile.lock, commonly Pipfile.lock, is a lockfile produced by the Python packaging tool Pipenv to accompany a Pipfile. It records the exact versions of all dependencies that were resolved for a project, including transitive dependencies, and their installation hashes. This information enables reproducible environments across different machines and later installations.

The file is written in JSON and typically contains sections such as _meta, default, develop, and sources. The default and develop sections map package names to objects that specify the resolved version (for example, "version": "==1.2.3") and a list of hashes used to verify integrity. The _meta section records metadata like the lockfile format version, the Python version in use, and the sources from which packages are retrieved. The sources section lists repositories (usually PyPI) with their URLs and verification requirements.

Pipfile.lock is generated or updated by commands like pipenv install or pipenv lock. It should be committed to version control to ensure that all contributors and CI systems install the same set of dependencies. When a new environment is created, Pipenv consults Pipfile.lock to install the pinned versions; if the lockfile is missing or outdated, Pipenv will resolve dependencies again and regenerate it.

Pipfile.lock is specific to Pipenv and is not directly used by pip, which relies on requirements.txt in other workflows. Some projects may adopt alternative lockfiles (for example, poetry.lock for Poetry), but Pipfile.lock remains the standard mechanism for Pipenv-managed projects to achieve reproducible installations.